Know Your Customer (KYC)

In one sentence: KYC is how a financial company confirms that a customer is who they say they are, and that the relationship presents an acceptable level of risk.

Why it matters

A company that does not verify its customers can be used to launder money or finance crime without knowing it. Regulators require KYC as a baseline control. Banking partners also require it as a condition of the relationship.

How it works in practice

KYC has three components: identity verification, due diligence, and ongoing monitoring.

Identity verification confirms that the person is real and that the documents they have submitted are genuine. In practice, this means checking a government-issued ID, matching the name and date of birth to the document, and for higher-risk customers, matching a live selfie to the photo on the ID.

Due diligence means checking the customer against sanctions lists, PEP databases, and adverse media. It also means assessing the customer's risk level based on their country, occupation, and intended use of the product.

Ongoing monitoring means watching the customer's behaviour over time and re-running checks when the relationship changes or when a trigger event occurs.

Red flags

• Customer provides documents that do not match each other or the stated identity
• Customer is reluctant to provide required information or documents
• Customer appears on a sanctions list or PEP database
• Stated purpose of the account does not match actual transaction behaviour
• Documents show signs of alteration or are from a high-risk jurisdiction

What regulators expect

FATF Recommendation 10 requires financial institutions to identify and verify the identity of customers before establishing a business relationship. Most national regulators have adopted this in law.

In the US, two separate FinCEN rules apply. The Customer Identification Program (CIP) rule (31 CFR 1020.220) requires covered institutions to collect and verify each customer's name, date of birth, address, and identification number at account opening. The Customer Due Diligence (CDD) Final Rule is a separate requirement: it covers beneficial ownership collection for legal entity customers and imposes an explicit obligation for ongoing monitoring of the customer relationship. These are different rules with different scope.

Common mistakes

Treating KYC as a one-time check at onboarding and not updating it when circumstances change. Over-relying on automated document checks without human review for edge cases.